RedLine Stealer Technical Intelligence Dossier

Executive Summary & Threat Architecture

RedLine Stealer (cataloged across threat research as RedLine, RedLineStealer, and Trojan:Win32/RedLine) is the most ubiquitous and commercially successful information stealer of the modern era, first appearing on Russian-language dark web forums in March 2020. Developed in .NET (C#), RedLine is operated under an aggressive Malware-as-a-Service (MaaS) subscription model, offering prospective affiliates standalone builds and access to a centralized management web panel for nominal fees. RedLine is designed to conduct sweeping, automated reconnaissance and theft of sensitive user telemetry across compromised Windows endpoints. Its targeting scope includes stored passwords, autofill form entries, credit card details, and session cookies from all major Chromium-based (Chrome, Edge, Brave, Opera, Vivaldi) and Gecko-based (Firefox) web browsers. Additionally, RedLine harvests session tokens from Discord, Telegram, Steam, and FileZilla, alongside aggressively sweeping for over 40 distinct desktop and browser-extension cryptocurrency wallets (including MetaMask, Phantom, Exodus, Binance, and Atomic Wallet). The malware is distributed through a vast variety of infection vectors, including malvertising campaigns on search engines, fake game cheats and cracked software on YouTube and GitHub, weaponized phishing documents exploiting CVE-2021-40444 and CVE-2023-38831, and initial-access loaders such as SmokeLoader. Network communication utilizes raw TCP sockets or SOAP/HTTP requests with encrypted XML and JSON payloads, frequently disguised as benign web traffic to bypass egress monitoring. RedLine's harvested credential dumps ('logs') form the foundational primary supply for illicit initial-access markets like Genesis Market and Russian Market, routinely enabling subsequent enterprise ransomware intrusions.

Observed Threat Aliases: RedLine Stealer, RedLineStealer, Trojan:Win32/RedLine, Win32/RedLine.A, MSIL/RedLine, RedLine.C

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: Proprietary origin

Documented Downstream Variants: redline_v1, redline_wcf, meta_stealer

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by RedLine Stealer operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Search engine malvertising distributing malicious installers disguised as popular software (AnyDesk, Notepad++, ChatGPT)
• YouTube video tutorials offering download links for cracked software, cryptocurrency bots, and game cheats
• Weaponized RAR/ZIP archives exploiting WinRAR remote code execution CVE-2023-38831 and Office CVE-2021-40444

Host Persistence & Execution Hooks

• Temporary execution from %LOCALAPPDATA%\Temp without permanent persistence (runs once, exfiltrates, and halts)
• Scheduled task creation in persistent variant deployments (task name: 'SystemUpdate')
• Startup folder shortcut placement under %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup

Reference File Hashes (SHA-256)

• 4a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c1
• 1025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a57
• e70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737b